blesta/coin_payments

Licensecaution

The artifact includes an MIT license file and the repository also has a license file, but the manifest declares the package proprietary. That conflict creates a real licensing and transparency concern.

Repo bus factorcaution

All three-month commit activity is concentrated in one contributor. Because the repository is organization-owned, handoff capacity may exist, but no second active contributor is shown.

Repo commit activitycaution

There was one commit from one active maintainer in the last three months, so maintenance activity exists but is sparse. The recent registry release and organization backing provide partial compensation, not a full replacement for broader activity.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tools are reported. For a payment gateway, the missing security scanning is a modest maintenance and transparency concern.

Security policycaution

The repository has no security policy. That weakens vulnerability-reporting transparency, particularly for a payment integration, although it is not evidence of abandonment by itself.